Date: Tue, 08 Sep 2009 23:37:04 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Andrew Storms <astorms@ncircle.com> Cc: "freebsd-security@freebsd.org" <freebsd-security@freebsd.org> Subject: Re: CVE-2008-4609 Message-ID: <86my55nmnz.fsf@ds4.des.no> In-Reply-To: <C6CBF6E8.26CD9%astorms@ncircle.com> (Andrew Storms's message of "Tue, 08 Sep 2009 11:56:24 -0700") References: <C6CBF6E8.26CD9%astorms@ncircle.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Andrew Storms <astorms@ncircle.com> writes: > Now that the details are out - MS and Cisco patched today. I went > looking back into the FreeBSD security announcements and don't seem to > be able to find any references for a patch. Did FreeBSD already patch > or discuss this bug and I missed it? This is old news: http://www.google.com/#&q=3Dsockstress The initial version was just connection flooding - they thought it was a big deal because they came up with a very clever and complicated setup to increase the flood rate, when in fact a short C program using bpf could have done the job just as well. When people pointed out that it was a load of bs, they started making wild claims about more serious attacks, the details of which would be released at the next compsec conference, except not really, because we're still working on it, but the next one, we promise, for real this time... Just read their website (http://www.sockstress.com/), it'll give you an idea of just how far off their rocker they are. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86my55nmnz.fsf>